Privacy Map

New Jersey. Breach notification. Act

NJ breach lawNew Jersey data breach notification law (N.J. Stat. §§ 56:8-161, 56:8-163)

In force
Partly verifiedMedium confidence. Perkins Coie New Jersey page could not be fetched; checked against Justia text of § 56:8-163. Penalty figure from NJ Consumer Fraud Act.

§1Summary

Synopsis

Requires businesses (and in most cases public bodies) that own or license computerised personal information about New Jersey residents to notify affected individuals after a security breach. Core timing rule: Division of State Police before individuals. Covered data: name plus SSN, driver's licence/ID, financial account with codes; online credentials.

Key themes
  • breach notification
  • personal information definition
  • regulator notice
  • consumer reporting agency notice
  • vendor-to-owner notice
  • encryption safe harbour
  • substitute notice
  • law enforcement delay
Unique features

Unique requirement to report to the State Police before notifying consumers; no-harm determinations documented and kept 5 years.

SaaS relevance

A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: New Jersey requires the maintaining entity to notify the owner immediately following discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.

§2Obligations

Extraterritorial
Limited
Breach notification
Division of State Police before individuals; individuals in the most expedient time possible; CRAs if >1,000
DPO
No
Cross-border transfers
None
Maximum penalty
Consumer Fraud Act penalties up to $10,000 first violation, $20,000 subsequent

§3Dates

Key dates
  • Adopted
  • In force
  • P.L. 2019, c.95 (eff. 2019-09-01) added online credentials

§4Text and authority

Text
Authority
New Jersey Division of State Police (notice); Division of Consumer Affairs / Attorney General (enforcement)

§5Where it applies

Domestic law of
New Jersey

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. Perkins Coie New Jersey page could not be fetched; checked against Justia text of § 56:8-163. Penalty figure from NJ Consumer Fraud Act.